Table of Contents

Class SsoCredentialsProvider

Namespace
DynaSharp.Credentials
Assembly
DynaSharp.dll

Supplies the credentials of a role in an account that AWS IAM Identity Center (SSO) gives the user who signed in with aws sso login, from the token that the AWS CLI caches, and refreshes them before they expire. This is what a profile with sso_account_id and sso_role_name does, see ProfileCredentialsProvider; this class is the same for code.

public sealed class SsoCredentialsProvider : IRefreshableCredentialsProvider, ICredentialsProvider
Inheritance
SsoCredentialsProvider
Implements
Inherited Members

Remarks

A fetch reads the cached token from ~/.aws/sso/cache/, from the file named by the SHA-1 of the session name in hexadecimal, or of the start URL when there is no session (the older form), as botocore does, and sends it as a bearer token to the GetRoleCredentials call of the portal, GET https://portal.sso.{region}.amazonaws.com/federation/credentials?role_name=...&account_id=.... The file is read at every fetch, so a new aws sso login takes effect at the next refresh. AWS_ENDPOINT_URL_SSO, then AWS_ENDPOINT_URL, replace the endpoint, as in botocore.

With a session, a token that expires within 15 minutes is refreshed first through the CreateToken call of the OIDC service (https://oidc.{region}.amazonaws.com/token, or AWS_ENDPOINT_URL_SSO_OIDC) with the refresh token and the client registration that the file holds, and the new token is written back into the file, as botocore does, so that the AWS CLI sees it too. A refresh that fails is logged as a warning and the cached token is used while it lasts. A token without a session is never refreshed.

A token that is missing, unreadable, malformed or expired, and one that the portal rejects (HTTP 401), fail with a CredentialsUnavailableException that says to run aws sso login. Each request has 5 seconds; a timeout, a connection error and HTTP 429 and 5xx are retried up to 3 attempts in total, one second apart. The credentials are refreshed with the windows of WebIdentityCredentialsProvider, and the provider is thread-safe. The tokens are secrets: they appear in no message, log or trace. The requests do not go through HttpHandler, and use the default proxy of the process.

Constructors

SsoCredentialsProvider(string, AwsRegion, string, string, string?)

Initializes a new instance of the SsoCredentialsProvider class.

public SsoCredentialsProvider(string startUrl, AwsRegion ssoRegion, string accountId, string roleName, string? sessionName = null)

Parameters

startUrl string

The start URL of the portal, for example https://my-sso-portal.awsapps.com/start: sso_start_url.

ssoRegion AwsRegion

The region of IAM Identity Center: sso_region.

accountId string

The account of the role, for example 123456789012: sso_account_id.

roleName string

The name of the permission set, for example ReadOnly: sso_role_name.

sessionName string

The name of the sso-session that aws sso login --sso-session signed in with, which names the cached token and lets it be refreshed. null for the older form, whose token is named by the start URL and expires without a refresh.

Exceptions

ArgumentNullException

ssoRegion is null.

ArgumentException

startUrl, accountId or roleName is null or empty, or sessionName is empty.

Methods

GetCredentialsAsync(CancellationToken)

Gets the credentials of the role, fetching or refreshing them when needed.

public ValueTask<AwsCredentials> GetCredentialsAsync(CancellationToken cancellationToken)

Parameters

cancellationToken CancellationToken

Stops this call from waiting. The fetch itself, which other callers may share, is not cancelled.

Returns

ValueTask<AwsCredentials>

The same AwsCredentials instance until it is refreshed.

Exceptions

CredentialsUnavailableException

There is no valid cached token (the message says to run aws sso login), or the portal does not return credentials. During the mandatory refresh period, the failure of a refresh is thrown as well.

OperationCanceledException

cancellationToken was cancelled.

TryInvalidate(AwsCredentials)

Drops credentials that DynamoDB rejected as expired, so that the next GetCredentialsAsync(CancellationToken) asks the portal again. A client does this by itself.

public bool TryInvalidate(AwsCredentials rejected)

Parameters

rejected AwsCredentials

The instance that was rejected. Any other than the current one has been replaced already, and is ignored.

Returns

bool

Always true: this source can be asked again.

Exceptions

ArgumentNullException

rejected is null.